public inbox for linux-xfs@vger.kernel.org
 help / color / mirror / Atom feed
From: "Darrick J. Wong" <djwong@kernel.org>
To: Brian Foster <bfoster@redhat.com>
Cc: linux-xfs@vger.kernel.org
Subject: Re: [PATCH 2/2] xfs: remove dead stale buf unpin handling code
Date: Tue, 11 May 2021 18:55:19 -0700	[thread overview]
Message-ID: <20210512015519.GX8582@magnolia> (raw)
In-Reply-To: <20210511135257.878743-3-bfoster@redhat.com>

On Tue, May 11, 2021 at 09:52:57AM -0400, Brian Foster wrote:
> This code goes back to a time when transaction commits wrote
> directly to iclogs. The associated log items were pinned, written to
> the log, and then "uncommitted" if some part of the log write had
> failed. This uncommit sequence called an ->iop_unpin_remove()
> handler that was eventually folded into ->iop_unpin() via the remove
> parameter. The log subsystem has since changed significantly in that
> transactions commit to the CIL instead of direct to iclogs, though
> log items must still be aborted in the event of an eventual log I/O
> error. However, the context for a log item abort is now asynchronous
> from transaction commit, which means the committing transaction has
> been freed by this point in time and the transaction uncommit
> sequence of events is no longer relevant.
> 
> Further, since stale buffers remain locked at transaction commit
> through unpin, we can be certain that the buffer is not associated
> with any transaction when the unpin callback executes. Remove this
> unused hunk of code and replace it with an assertion that the buffer
> is disassociated from transaction context.
> 
> Signed-off-by: Brian Foster <bfoster@redhat.com>

<nod> my brain kinda hurts now, but I have a vague recollection of
wondering how you could get a stale buffer that was also being
removed and not being able to figure out how one might stumble into this
chunk of code. :)

Reviewed-by: Darrick J. Wong <djwong@kernel.org>

--D

> ---
>  fs/xfs/xfs_buf_item.c | 20 +-------------------
>  1 file changed, 1 insertion(+), 19 deletions(-)
> 
> diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
> index 7ff31788512b..634abf30b5bc 100644
> --- a/fs/xfs/xfs_buf_item.c
> +++ b/fs/xfs/xfs_buf_item.c
> @@ -517,28 +517,10 @@ xfs_buf_item_unpin(
>  		ASSERT(xfs_buf_islocked(bp));
>  		ASSERT(bp->b_flags & XBF_STALE);
>  		ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
> +		ASSERT(list_empty(&lip->li_trans) && !bp->b_transp);
>  
>  		trace_xfs_buf_item_unpin_stale(bip);
>  
> -		if (remove) {
> -			/*
> -			 * If we are in a transaction context, we have to
> -			 * remove the log item from the transaction as we are
> -			 * about to release our reference to the buffer.  If we
> -			 * don't, the unlock that occurs later in
> -			 * xfs_trans_uncommit() will try to reference the
> -			 * buffer which we no longer have a hold on.
> -			 */
> -			if (!list_empty(&lip->li_trans))
> -				xfs_trans_del_item(lip);
> -
> -			/*
> -			 * Since the transaction no longer refers to the buffer,
> -			 * the buffer should no longer refer to the transaction.
> -			 */
> -			bp->b_transp = NULL;
> -		}
> -
>  		/*
>  		 * If we get called here because of an IO error, we may or may
>  		 * not have the item on the AIL. xfs_trans_ail_delete() will
> -- 
> 2.26.3
> 

  reply	other threads:[~2021-05-12  1:55 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-11 13:52 [PATCH 0/2] xfs: fix buffer use after free on unpin abort Brian Foster
2021-05-11 13:52 ` [PATCH 1/2] xfs: hold buffer across unpin and potential shutdown processing Brian Foster
2021-05-12  1:52   ` Darrick J. Wong
2021-05-12 12:22     ` Christoph Hellwig
2021-05-12 14:29       ` Brian Foster
2021-05-12 14:28     ` Brian Foster
2021-05-11 13:52 ` [PATCH 2/2] xfs: remove dead stale buf unpin handling code Brian Foster
2021-05-12  1:55   ` Darrick J. Wong [this message]
2021-05-12 12:00   ` Christoph Hellwig
2021-05-12 14:29     ` Brian Foster
2021-05-12 14:30   ` [PATCH v1.1 " Brian Foster

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210512015519.GX8582@magnolia \
    --to=djwong@kernel.org \
    --cc=bfoster@redhat.com \
    --cc=linux-xfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox